Skip to content

FRM Part II · FRM Exam Part II · Case Study: Cyberthreats and Information Security Risks

A bank's cyber risk team estimates that a ransomware event has an annual probability of 8%. If it occurs, the expected loss is USD 5 million. A new endpoint detection control is expected to reduce the event probability by 25% (relative) and cut the loss severity by 40% if an event still occurs. The control costs USD 90,000 per year. What is the net annual benefit of the control (reduction in expected annual loss minus cost)?

The net annual benefit is USD 130,000. Expected loss falls from USD 400,000 (8% x 5 million) to USD 180,000 (6% x 3 million), a USD 220,000 reduction, and subtracting the USD 90,000 annual control cost leaves USD 130,000.

  1. AUSD 70,000Correct
  2. BUSD 130,000
  3. CUSD 160,000
  4. DUSD 220,000

Explanation

Current expected loss = 0.08 x 5,000,000 = 400,000. New probability = 0.08 x 0.75 = 0.06; new severity = 5,000,000 x 0.6 = 3,000,000; new expected loss = 180,000. Reduction = 220,000; less cost 90,000 gives 130,000. Check: the option of 220,000 ignores the cost. Re-checking the arithmetic, net benefit is 130,000, so the key is the option of USD 130,000.

Did you get it right without looking?

One question tells you little. A timed set on Case Study: Cyberthreats and Information Security Risks shows your real accuracy, how long you take and where you lose marks.

Practise Case Study: Cyberthreats and Information Security RisksFree diagnostic mock

More Case Study: Cyberthreats and Information Security Risks questions